I want to store credit cards just long so I can see the credit card number, maybe one week, and then remove them. In Canada we don't have automatic AVS, so if an order looks suspicious we need to call the card issuing bank to do an address verification over the phone, we need the full number to do this.

You could always print out the form in hard copy and delete cc only. Other ideas, password protect the folder that has the admin section, only allow certain IP's to connect to the admin section and make sure that the encrypt cc option is set to yes within the site.